###############################################################################
#                                                                             #
#                          MALICIOUS URL & DOMAIN EDL                         #
#          URLs and Domains for URL-category EDLs (threat-intel-feed)         #
#                                                                             #
#  Purpose: IOC - Malicious URLs + domains (score >= 50)                      #
#  Format:  one URL or FQDN per line, no scheme; '#' = comment                #
#  Usage:   Palo Alto URL EDL, web proxy                                      #
#  Updated: 2026-10-27 03:12 UTC   Count: 242   Expiry: 30 days               #
#                                                                             #
###############################################################################


# Auto-Fetch-ThreatIntel: ThreatFox
# Malware payload URLs / TLP:CLEAR - Threat Level: Medium
# 2026-10-27

a.agia4d.org/b1
a.agia4d.org/dmy
a.agia4d.org/j
a.agia4d.org/k
a.agia4d.org/k4
a.agia4d.org/ov
a.agia4d.org/rk
a.agia4d.org/rr
a.agia4d.org/s2i
a.agia4d.org/sv
a.agia4d.org/t
a.agia4d.org/u


# Auto-Fetch-ThreatIntel: ThreatFox
# C2 & phishing domains / TLP:CLEAR - Threat Level: Medium
# 2026-10-27

airport-homes.com
b.ayu99.pro
bluedoggdesign.com
burnoutblog.lieselotmaes.be
catsport.it
centrealestetic.com
clinicadivinoninojesus.org.pe
clinicavetcenter.com.br
codes.caffe-img.com
constructoraags.com.do
dbperformance.com
dec-llc.net


# Auto-Fetch-ThreatIntel: ThreatFox
# Malware payload URLs / TLP:CLEAR - Threat Level: Medium
# 2026-10-26

104.238.149.90/login
16.5.0.150:8080/q4w8z.x86
94.154.43.195/bins/arm
94.154.43.195/bins/arm5
ac.agenpr.org/b
ac.agenpr.org/ea
ac.agenpr.org/fn
ac.agenpr.org/ft
ac.agenpr.org/fv
ac.agenpr.org/pg
ac.agenpr.org/pl
ac.agenpr.org/t
ac.agenpr.org/tf
ac.agenpr.org/ty
ac.agenpr.org/ue
b.ayu99.pro/k
chant66.com/curl/4c0rmvw61d6/q1sfb31ar08qqofqjduay.dat
chant66.com/f/nt5ax1_btyoxzizb9whm9q/nuyar9lb
dk.agia4d.org/n
dk.agia4d.org/ob
dk.agia4d.org/pmz
dk.agia4d.org/vn
e.ayu99.pro/c
e.ayu99.pro/h
e.ayu99.pro/s
f.agenplay89.org/bq
f.agenplay89.org/cv
f.agenplay89.org/cx
f.agenplay89.org/dd
f.agenplay89.org/e0x
f.agenplay89.org/ki
f.agenplay89.org/lx
f.agenplay89.org/o
f.agenplay89.org/qx
f.agenplay89.org/t
f.agenplay89.org/t3
f.agenplay89.org/t9
g.agenplay89.org/zn
garden-82.com/curl/c7d2xn1k0/fmv7bafu0t42u1byn1.dat
garden-82.com/f/zh2s2xptaamrnzpdyiq0ng/vj1ury4s
h4.agenplay89.org/bl
h4.agenplay89.org/cy
h4.agenplay89.org/ho
h4.agenplay89.org/jo
h4.agenplay89.org/jp
h4.agenplay89.org/mn
h4.agenplay89.org/ob
h4.agenplay89.org/qf
h4.agenplay89.org/rp
h4.agenplay89.org/up
h4.agenplay89.org/z9
h4.agenplay89.org/zb
i.amo98.org/f
i.amo98.org/l
kavasa8f.beget.tech/L1nc0In.php
lr.agenpr.org/c4
lr.agenpr.org/e66
lr.agenpr.org/fy
lr.agenpr.org/gi
lr.agenpr.org/ja
lr.agenpr.org/k0b
lr.agenpr.org/kk
lr.agenpr.org/p
lr.agenpr.org/pj
lr.agenpr.org/u6
lr.agenpr.org/x
m.agenpr.org/ck
m.agenpr.org/i
m.agenpr.org/jt
m.agenpr.org/l
m.agenpr.org/mh
m.agenpr.org/nz
m.agenpr.org/ol
pm.agenpr.org/m4
pm.agenpr.org/r56
pm.agenpr.org/w
pm.agenpr.org/x
pt.agenpr.org/a
qtr.agenpr.org/b7
qtr.agenpr.org/cb
qtr.agenpr.org/egs
qtr.agenpr.org/h4
qtr.agenpr.org/j4
qtr.agenpr.org/kcv
tx.abad777.org/r
wx.agenpr.org/bb
wx.agenpr.org/d2
wx.agenpr.org/df
wx.agenpr.org/f


# Auto-Fetch-ThreatIntel: ThreatFox
# C2 & phishing domains / TLP:CLEAR - Threat Level: Medium
# 2026-10-26

1p289c94.betballl90.app
3413718a.exploreargentina.tours
3cb50pyi.warmwaffles.com
5gs2zjcc.fazbet1.app
ab41vc541fd04435740.health-carereform.com
anj99u86.verticalrewards.com
at.adwgamestore.org
attractions.oppasharing.com
ayuntamientodeprogreso.gob.mx
balsamdolmen.org
baydounappliances.com
bb6lxq63.verticalrewards.com
bbwptlox.dota.pw
bet212.live
betballl90.app
blog.cdc7.net
blog.paipweb.com
blog.universe-edge.ru
buecher.hagalil.com
bzxlc31w.ghostnode.us
c.aot88.com
c.aww88.net
cbg80csz.deurnenwinkel.com
church.springsoflife.org
cinderfetch.cc
civil.rezendenetto.adv.br
commithealthandwellness.com
concreterepairny.com
cpw81zy7.emanuellejaques.com
cy9.narahtech.com
dance.pappu.co.in
dash.erosteps.in
dccidadu.org.pk
debug.pingload.cc
deesaidesign.com
du03146t.eromeofficial.us
e.ayu99.pro
eczy948u.georgelounge.com
familylegacyprotection.com
figieiredo.lol
firebase.emeraldpineventuresllc.com
flexyyservices.pt
formazionedocenti.org
francescmarcalvaro.cat
ftp.jmacsafety.com
ftp.prometeon.info
ga.adwgamestore.org
galerie-dakoenig.de
garden-82.com
gcnj52gi.bet212.live
globalintermed.com.br
grant.vandersee.id.au
gventerpriseswork.com
h5.adwgamestore.org
hu406sua.ozabet.promo
idrive.ba
iejzff0w.etablissementsbonnet.com
iict.gov.la
ilovevirginiabeer.com
imhoteplukata.com
ioypdsgj.dota.pw
jj.adwgamestore.org
k2rf8oi3.energedia.com
kianm3aw.thrivingchaos.com
m.aot88.com
majastee.com
nt5kwuux.paars.poker
object.glimmerpull.cc
pm3c7bwl.encompass-graphics.co.uk
relay.reelxgrab.cc
t0kmixg4.glas-design.shop
td3avpdc.dota.pw
thrivingchaos.com
tuffcromlech.info
vm.adwgamestore.org
ww.adilawa99.org
ya.adwgamestore.org
z.amo98.org
z0bhclq0.energedia.dev
zfvg0vcv.forbesae.com
zz-infratechniek.nl


# Auto-Fetch-ThreatIntel
# Malware payload URLs / TLP:CLEAR - Threat Level: Medium
# 2026-10-25

bitfinance.live/cgi-sys/defaultwebpage.cgi
nest-52.com/curl/qwafbxxe971/re5qltb29l0wle432.txt
nest-52.com/f/zh2s2xptaamrnzpdyiq0ng/vj1ury4s
v.amo98.org/x
zen.ayxandevgang.workers.dev/m/license-20260928125936-24d9


# Auto-Fetch-ThreatIntel
# C2 & phishing domains / TLP:CLEAR - Threat Level: Medium
# 2026-10-25

791n1fiv.enfejbaaz.bet
9gul6aad.mon-iam-espace-esa-lia.online
arabianlibas.com
bharatlivestock.farm
bonanza333gac0r.space
bookpublishingventure.com
bran.lol
drtianna.com
ivanitsky.com
ivh.uvaoficial.com
mon-iam-espace-esa-lia.online
mooc3.politechnicart.net
nikinovin.com
river.marine-force-ishigaki.com
teacher.adm-edu.ru
timenews247.com
u6.adilawa99.org
uniporctandil.com.ar
vitsmare.pages.dev


# Auto-Fetch-ThreatIntel
# Malware payload URLs / TLP:CLEAR - Threat Level: Medium
# 2026-10-24

160.119.66.206/bins/net.arc
196.251.107.186/8jdjZhdf7/index.php
becheglokevevetoglo.beiksk.my.id/win/index.php?vq=p3XT5sNwHLY0JhBAxOGqE2dNbXFDMGZsWERNelRTWTh6V1BFUXlINTZQWnpqb2lHVGFIZ0wyTlB0bGlCSUFyOE9RdGxkbmpFTHc1U3A3dFZMUzN0MUdJZkhFWDY1c3U0YjU4cDdRKytsc2U0dC84eCtDb0tseTdqcGhML3lYQ0haZDF3ZVhMNXdBU1RUWmIyR3E3WUtYTCtHUFVDS0RsaGFtOFI1bjVIV2ZVbk9zN045WVhhdlF4WjIrQldHdVEwbjFCdDU4bHdHcVFEQUgvSw==
bzf168.com/loader.ps1
indigo-finch-misgoaen.life/t.js?site=07c3730c3a7e0cdc33104bbd16e756a9
mesa-zaimmuen.life/t.js?site=22bb70d66057a56d34dc29c5b847ae83
orienttaxtile.com/tues/crypted.ps1
petal2380.pages.dev/win/index.php?vq=dC9lIgV5hOV093/k8lLF6jRCWG1OQ25vaDlCbU9vSmVlaDlBN3JYWXowek8wMENYZ0JMN3UzaVJVdWdqNFpMalJtRU5WalE1RVV4QnBDMEE4R29Da1oyamtQa21xQ01ZdCtaTGIybjhzQlN3T2tLT28rMy9pU1FDSGxWcWxkam9lVUtHY1JSa3NKdm0vTzZQVkF4L0FscDNFOHdkalZ6Smg2Y1lYZzBWM045dDlQMVJJOWNjVFJRU3VsU2Uwd2RxeGRjWkdLNTBsZjh4RnJ2TA==
pixxarting21.life/t.js?site=8877e14b1cd4aa573aea550c2ae9c73d
satin-burst19.pages.dev/win/index.php?vq=nxsYfEh3AmI4Wjjxn7UwD1FtbWJnMGE1WkFoODN4d1ZaTy9LSlVSMXE0L25QQTR5TnR3Q3lqcVdLY201ZUtEMVNPNXpKcjRrSE4zeEZLUzQvT3R3QXQ2aWFWVXZ1bzJISWRscVhuVXg5eG9nL2w4TmNpckpneCtrRzZONTFiaFVrb0FxNzF0dSswbjFydEw0V3QwTENwZkk5VW02ZlVLcktZeUlWRmZLOENja2JlYVphK2NJblBhZmFPQStNK2ZLYndvNGl0ZXd3N0V0Q3ZpUQ==
vivid-roam-cove-gleon.life/t.js?site=7f469927630a01245c8e1125bfe9f9cc


# Auto-Fetch-ThreatIntel
# C2 & phishing domains / TLP:CLEAR - Threat Level: Medium
# 2026-10-24

1moko8um.encompass-graphics.co.uk
1pbwy4ua.yellohotelsharmoni.com
3u8krmfu.energedia.com
4m8axf47.worknernorgram.rest
adbimmo.cs-projets.be
de.remusdownloads.su
energedia.com
gbhpljne.paars.poker
manzzkontolaktolakan.my.id
mytutions.com
n2late.fr
new.decorhome.kz
rf.adilawa99.org